Skip to main content

Disclaimer: Educational purposes only. Not legal advice. Consult a qualified NZ legal practitioner for your specific circumstances.

SimplifiedLaw.co.nz
general

Accessing your personal information: Making a Privacy Act request

Key Takeaway

Under New Zealand's Privacy Act 2020, individuals have a right to request access to their personal information held by organisations. Requests must be in writing, and agencies generally have 20 working days to respond. Grounds exist for refusal, and individuals can complain to the Privacy Commissioner if dissatisfied with the outcome.

Accessing Your Personal Information: Making a Privacy Act Request

In New Zealand, the Privacy Act 2020 establishes rules for how agencies—including government departments, businesses, and organisations—collect, hold, use, and disclose personal information. A core aspect of this legislation is an individual's right to access information held about them.

The Right to Access Personal Information

Individuals have a fundamental right to request access to any personal information an agency holds about them [Source: Privacy Act 2020, Information Privacy Principle 6].

  • Personal information refers to any information about an identifiable individual [Source: Privacy Act 2020, s 7]. This can include names, contact details, medical records, employment history, and financial details.
  • An agency is broadly defined to include most organisations, businesses, government departments, and individuals collecting, holding, and using personal information [Source: Privacy Act 2020, s 7].

Who Can Make a Request?

Any individual about whom personal information is held may make a request for access to that information [Source: Privacy Act 2020, s 41(1)]. A request can also be made by an individual's agent, such as a lawyer or family member, if they are properly authorised to act on the individual's behalf [Source: Privacy Act 2020, s 41(2)].

How to Make a Request

To ensure clarity and a formal record, a request for access to personal information must be made in writing [Source: Privacy Act 2020, s 42(1)]. The request should clearly specify the personal information sought with due particularity, meaning it should be specific enough for the agency to identify the information [Source: Privacy Act 2020, s 42(2)(a)].

Agencies are permitted to ask for evidence of the requester's identity to ensure the information is being released to the correct person [Source: Privacy Act 2020, s 43(1)]. This is an important safeguard against unauthorised disclosure.

Timeframes for Responding

Once an agency receives a valid request for personal information, it must decide whether to grant the request and notify the individual of its decision as soon as reasonably practicable. In all cases, this decision must be made and communicated no later than 20 working days after the day on which the request was received [Source: Privacy Act 2020, s 44(1)].

In some complex cases, an agency may extend this 20-working-day timeframe. If an extension is necessary, the agency must inform the requester in writing, provide the reasons for the extension, and state the new date by which the decision will be made [Source: Privacy Act 2020, s 44(3)-(5)].

Cost of a Request

Generally, an agency may not charge a fee for making personal information available to an individual [Source: Privacy Act 2020, s 46(1)]. However, a fee may be charged if specific regulations allow for it, or if the individual requests the information in a particular form or format that incurs a reasonable cost (e.g., specialised printing or scanning) [Source: Privacy Act 2020, s 46(2)-(3)].

Reasons for Refusing a Request

While individuals have a right to access their personal information, this right is not absolute. An agency may refuse to grant a request for access under specific circumstances, including:

  • Releasing the information would endanger the safety of any individual [Source: Privacy Act 2020, s 49(1)(a)].
  • The information is subject to legal professional privilege [Source: Privacy Act 2020, s 52(1)(a)].
  • The information is evaluative material supplied in confidence [Source: Privacy Act 2020, s 53(1)].
  • Releasing the information would involve an unwarranted disclosure of the affairs of another identifiable individual or a deceased person [Source: Privacy Act 2020, s 50].
  • The information is not readily retrievable without substantial difficulty [Source: Privacy Act 2020, s 57(1)(a)].
  • The request is frivolous or vexatious, meaning it is trivial, annoying, or designed to cause harassment [Source: Privacy Act 2020, s 57(1)(b)].
  • Making the information available would require substantial collation or research [Source: Privacy Act 2020, s 57(1)(c)].
  • Making the information available would breach another enactment (law) [Source: Privacy Act 2020, s 58(b)].

If an agency refuses a request, it must provide the individual with written reasons for the refusal, citing the specific ground for refusal under the Privacy Act 2020 [Source: Privacy Act 2020, s 45(1)(a)].

Right to Request Correction of Personal Information

In addition to accessing personal information, individuals also have the right to request that an agency correct any personal information held about them that is inaccurate, incomplete, or out of date [Source: Privacy Act 2020, Information Privacy Principle 7]. If the agency does not agree to correct the information, the individual may request that the agency attach a statement of the requested correction to the information [Source: Privacy Act 2020, Information Privacy Principle 7(3)].

What to do if a Request is Refused or Not Responded To

If an individual is dissatisfied with an agency's decision regarding an access request—for example, if the request is refused, or the agency does not respond within the statutory timeframe—a complaint can be made to the Privacy Commissioner [Source: Privacy Act 2020, s 67(1)(a)]. The Privacy Commissioner can investigate the complaint, attempt to resolve it through conciliation, and has powers to make formal determinations [Source: Privacy Act 2020, s 68 and Part 5 generally].

When to Seek Independent Legal Advice

Individuals seeking to understand their specific rights regarding personal information, particularly if a request has been refused or if the situation involves complex legal issues, should seek independent legal advice. The Privacy Commissioner's office can provide guidance on privacy matters, and Community Law Centres offer free legal assistance and information on a range of issues. Contacting these bodies can help determine the best course of action.

Key Resources